Karsten Hahn @struppigel

MalwareAnalysisForHedgehogs, Principal Malware Researcher at GDATA, he/him 🦔🌈🏳️‍⚧️ ko-fi.com/struppigel Germany Joined May 2014

Tweets

9K
Followers

24K
Following

756
Likes

24K

vx-underground @vxunderground

a day ago

Malware Noob Month Post #4 Does malware need to be written in C or C++? No. You can write malware in any language you want. In fact, I encourage you to write malware in other programming languages. The reason why C (or C++) is so common is because, as is tradition, it has some…

30 45 647 52K 127

Karsten Hahn @struppigel

5 days ago

In light of the new course, I created a Discord server for MalwareAnalysisForHedghogs to discuss malware analysis related topics. You can join here--this is for every malware enthusiast, not only course members: discord.gg/3evhC4cj

2 15 79 8K 36

Karsten Hahn @struppigel

6 days ago

My intermediate level malware analysis course is there. 60% off for the next two weeks. …nalysis-for-hedgehogs.learnworlds.com/course/interme…

5 45 188 15K 90

Karsten Hahn @struppigel

6 days ago

This blog post about impostor certificates by @SquiblydooBlog is a gem and very relevant right now. Or: How threat actors impersonate companies to obtain authenticode certificates for signing their malware. And why revokation is important. squiblydoo.blog/2024/05/13/imp…

0 43 161 12K 76

Utku Çorbacı @rhotav

a week ago

dnpy - A Python library for reading .NET assemblies. It's not finished yet, but its current state is sufficient for many tasks. Using only dnpy (without needing another project), you can parse a .NET assembly, iterate through its methods, and read its instructions.…

1 8 40 4K 11

Karsten Hahn @struppigel

a week ago

Some threat actors are bold enough to submit their malware as false positive to antivirus companies. This also happened with AppSuite PDF Editor. Our technical deep-dive is out 📝 gdatasoftware.com/blog/2025/08/3… #GDATA #GDATATechblog #AppSuite

6 36 123 8K 50

Gizmo @TeamDreier

2 weeks ago

#TamperedChef SIE Europe passive dns analytics with UMAP clustering shows that the campaign is ~1000 domains and all domains on AWS. SW Signing certs is revoked and webpage certs changed to amazon. All domains uploaded to UrlScan (700k records analysed) @JAMESWT_WT @struppigel

4 4 22 4K 6

Download Image

_ark_ (@[email protected]) @is_henderson

2 weeks ago

#Oyster Loader #MalwareAnalysis is out. Please let me know what you think, if it's helpful, and what needs to be improved on for the next one. Thanks to my colleagues for help on this and the heavy lifting. I learned a lot doing this. www2.bluevoyant.com/OysterBackdoor…

0 10 23 2K 7

YungBinary @YungBinary

2 weeks ago

Seeing a (potential new?) python-based backdoor we're tracking as #PyNightshade for the second time delivered via #ClickFix that uses sockets for C2. Supports several commands from C2, including: remote shell, uploading files from the victim host, and self-deletion. It uses RC4…

2 40 173 16K 75

Download Image

Squiblydoo @SquiblydooBlog

2 weeks ago

@nhegde610 @struppigel In many cases, we’ve seen hosts infected for weeks or months. In my tracking of certificates, I think this actor has been active for a few years pushing PUP-like files.

0 2 6 1K 1

Stef @StefC1993

2 weeks ago

@struppigel Our SOC got multiple of these cases this week as well. All PDF-related. Most (if not all) cases have a delay of at least 10 days between initial execution of the downloaded software and execution of malicious .js files. (1/2)